Guides for customer security reviews
Practical help for a software company whose customers have started asking how it protects their data. Pick the stage you're at: getting ready, in the middle of a review, or looking up a term.
Before the first review
Decide what to publish, and put the basics in place.
- What to put on a security pageThe sections a trust center needs, and what a good version of each looks like.
- Cyber Essentials for software companiesWhat it covers, what changed in 2026, what it costs, and how to show it to buyers.
- Notion trust center alternativeWhere a DIY security page breaks down, and when it's still fine.
- security.txt generatorCreate an RFC 9116 security.txt file for your website.
- Vulnerability disclosure policy generatorWrite a VDP with scope, response times and a safe harbour statement.
During a review
A customer has sent a questionnaire or asked for documents.
- Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit, with worked answers.
- Vendor security reviewWhat a reviewer will ask you for, and how to answer it before they ask.
- Share security documents securelyPublic, on request or private: how to hand over a SOC 2 report without an email thread.
Security questionnaire answers
The questions that appear on almost every questionnaire, each with a model answer, the evidence behind it, and what to say if you don't do it yet.
- Do you enforce multi-factor authentication?
- Do you review user access regularly?
- Is customer data encrypted in transit and at rest?
- How long do you keep customer data, and how is it deleted?
- Do you back up customer data?
- Do you have a disaster recovery plan?
- Do you have an incident response plan?
- Will you notify us of a security breach, and how quickly?
- How do you manage vulnerabilities?
- Do you perform penetration testing?
- Do you perform background checks on employees?
- Do employees receive security awareness training?
- How do you assess the security of your vendors?
- Is our data used to train AI models?
- Do you have an AI use policy?
Glossary
The terms in a security review, in plain English.
Subprocessors by category
The vendors companies list, grouped by what they do.
Questions worth asking
What people ask when the first security review lands.
Where should I start if a customer has just sent a security questionnaire?
Start with the guide on answering a questionnaire without SOC 2, then look up each question in the questionnaire answers below. Each has a model answer and what to say if you don't do it yet.
Do I need SOC 2 to get through a customer security review?
No. Many reviews can be answered honestly with your current practice, a list of your controls and a maintained security page. SOC 2 reduces repeat questions later, but it isn't a requirement for answering the review in front of you.
What should be on a company security page?
Your controls, compliance status, the documents reviewers ask for, your subprocessors and a way to report a vulnerability. The checklist guide covers each section and what a good version looks like.
Are the questionnaire answers legal or compliance advice?
No. They are model wording for you to adapt, with square brackets where your own facts go. State only what is true for your company.